EthCC 2: Arthur Gervais

good morning everyone my name is Arthur I'm gonna present you in okis today it's a scalable a securely scalable Committee chain so it's a scaling solution for permissionless doctrines so I'm not gonna motivate why we need to scale auctions because I believe everybody is kind of aware of the current state of scalability limitations and I'm gonna focus today in my talk on a second layer it's more specifically on 2nd layer solutions which do not require an additional consensus mechanism so science for example they require additional consensus mechanisms and this is not part of the story so one possible solution on the second layer are to party payment channels so in a two-party payment channel you have private ledger which is privately maintained between two entities and there are typically three phases so there's an opening phase there's a live face and then a closure dispute phase close the channel so there are two Unchained transactions which are involved one in the open phase one in the closed phase in the life face you can exchange as many off chain transactions as fast as you want between among those peers so the off chain transactions are typically secured by a non Shane escrow that one or both parties committed to the chain at the in the opening phase and then they can just exchange off the chain funds which are smaller than the on Shane escrow and that's why those are secured the second class of second layer scalability solutions are commit chains so in a commit chain we have a central operator here where there are like an a party a number of parties n that can become part of this commission and there's actually only one phase and this is the periodic commits of the off change state to the parent ledger to the parent rock chain hence we call it a commission because their periodic commits so if you have a blockchain and here I just did to eliminate some blocks and block I program plus one and you have a commission operator with some users then this commit chain operator will commit a constant size checkpoint to the underlying ledger and that's not just the hash of the of the overall of chain State so now let's assume those users perform some of the change in sections among themselves right so these can be as many as possible among those members of this commission and then the operator will condense them into one single hash which is hashed on the on the parent ledger and and so on and this is done in periodic intervals and we also call this period around in the in the following what's important is that the users actively check whether this checkpoint is integral whether it represents properly the off chain State right so it could have been that the operator changes someone tries to change some contents and if this if this were then the users can issue so-called challenges on the parent chain so the parent chain is really just used as a weak host for disputes so what's interesting is that this commits chains they have very interesting features compared to for example lightning if one members offline you can still receive the transaction so this is very similar to the guarantees or the usability that you get for Unchained transactions right you don't need an e3 young user or pit burn client to be online to receive a transaction button in to party payment terms such as I think it's currently required while in the commit chain with you don't need to be online and those transaction can be instant as well so however contrary to on chain transactions the users need to be online once per round so they cannot remain offline forever they should check their state more specifically the Check Point they interviewed the integrity of the check point regularly so if the operator does not provide any collateral then a Kermit chain has delayed finality so what do I mean by delight we know it's a delayed finality is here this time period of around as long as your transaction you're off the chain transactions are not committed to the parent ledger they can be reverted they are not finalized on the parent chain that's why delayed finality but it's interesting because we can do off the chain transactions without collateral and by the intermediate operator and achieve delayed finality which is not something that payment channels can provide so if we do not have collateral by the operator then the recipient should wait for a transaction to confirm and this can last for quite awhile if we do have collateral so if the operators take some collateral here in the in the middle so this central operator then he needs to ensure this period so the transaction volume of a period needs to be ensured so if something happens if the object transactions cannot be committed on chain these transactions need to be insured through some insurance pool this insurance pool has very interesting properties it can be reused every round so we can think of it like you have your credit card you have a monthly budget right you get a monthly allowance I don't know a few thousand bucks and it's the same so every insurance period you get the same allowance right you get an incoming incoming transaction volume that you can actually expect that you can actually receive so it's the receiver that needs to be insured given this collateral the transactions can be accepted instantly because you know if the operator goes down while I have my insurance pool I can always reclaim the funds that I've received I think what's even more important is that this collateral provided by the operator can be attributed to all peers of the Commission with only one on chain transaction so even if you have a billion users on your commit chain you only need one on chain transactions in order to allocate the collateral specifically to each user last but not least we can join me change transactions without any unchanged transaction so if an upir wanna join he just sends a cyan't TCP message to the operator and he's part of the pool he can already receive commit change transactions so it's instant and it doesn't cost any gas so it's serial too friendly [Music] so to summarize no caste Commission offers delayed finality without collateral it offers instant in a little with collateral that can be reused every round transaction recipient can be offline so no need to have your phone open internet connection etc in order to receive a transaction you can join a commission without any on chain transaction so user onboarding of million users doesn't cost you anything and there's a fair mass exit so if the operator dies every account will be closed fairly so that's very important if you imagine you build to party payments and a half you cannot guarantee that every channel will be closed fairly because there in the event of a mass exit there will be a gas war and you're not certain that every channel every isolated channel is closed in a fair manner so you might say wait you're talking here about a central operator I like decentralized networks why do you present us here such a centralized system while you're right it's a centralized system as long as you have only one of these commissions so we might think of a future where we have several Commission's that talk to each other that you can route payments across but more more importantly those central operators they are untrusted and noncustodial so the only thing that they can do is they can censor off-the-chain transactions they can not allow you to join the comet chain they can tell you I will not forward this off chain transaction but they cannot prevent you from taking out your form your coins they cannot steal your coins they cannot double spend your coins and also cannot mint new coins and if you're unhappy or everybody is unhappy about the malicious commit chain operator well it's easy to migrate to a new one so the key innovation of how this actually works is it's a localized interval tree so you can see here we have an account tree that accounts for the individual accounts of the users and every intermediate leaf of this Merkle tree is annotated with the subsequent among so it's not just as some tree and local some creates an interval tree we do have two different types of accounts one active tree one passive tree the passive tree is what enables us to do transactions or to send transactions to recipient that is offline so the full details are actually in our public paper that you can find on ePrint so we've gone a bit further in and we have introduced ZK snarks in order to construct provably valid check points so users are no longer required to audit the integrity of the check points that are committed on check they are still required to audit the liveness of the check points but the smart contract would halt a commission operator immediately upon misbehaving so what are the security properties let's look at some examples let's assume the notice operator disappears just after a checkpoint so the operator submits the Genesis checkpoint to kind of kick off the commit chain and then let's assume there are hundred transactions that are happening in the network so those hundred transactions are condensed via the murk realized interval tree into one checkpoint hash and it's committed on chain let's assume this happens again and just after this checkpoint the operator misbehaves but either by just running away or just crashing so the transaction 1 to 200 are committed on the chain because they are in the checkpoints here and as such every user of the commission can safely withdraw them from the smart contract from the notice my contract so everybody's happy let's assume the following which is a bit more complicated so again we have an initial Genesis checkpoint a few hundred transactions another hundred transactions and other xxx transactions and then the operator dies so we know from the example before well one the transactions one to two hundred or five right they're secure however transactions after this which I've not yet confirmed on chain well they are kind of lost they reverted because they're never they're never going to be committed to be to the parent chain luckily we have an insurance pool that allows you to recover those protections that are lost so more specifically the recipients of those transactions need to claim their insurance pool on chain to us and this is also the feature that allows you to have instant finality of transactions because you know even if the operator dies I can always get more money back from the unchain escrow so what about double spending so let's say we have Bob which is a malicious user of the commit chain he has two accounts Bob and Bob Prime and so in the current in the current buy in the current vocalist in the interval tree so in this one here which is the country in the picture from before let's assume they're 50 ether so Bob wants to send one transaction off the chain with 50 ether to Alice and then the second transaction worth 50 either to Bob so he wouldn't be able to do this because the operator here needs to sign this this transaction and as long as the operator doesn't collude with Bob you cannot have expect easy example so let's make it more complicated so now we have pop who is colluding with the operator so we have a malicious operator with a malicious user yes you can double spend in this case so Bob would would successfully send the transaction of 50 ether to Alice and and an off chain transaction of 50th or two to his own account or prime but what would happen then well this is this is actually only possible either by the attempt of the operator to create coins so in order to to properly credit Alice 50 ether and pop 50 ether we need to extend the currently only 50 ether that are collateralized in the mocha smart contract we need to double them right I mean 50 plus 50 is 100 so the smart contract will directly tell to be awkward to sorry you you have accounted for hundred ether I only have fifty in my pool you're gonna die off the second example is where the operator tries to steal coins so if he tries to steal coins then Ellis will see that your checkpoint under the checkpoint that is representing her balance is invalid and he can you can just challenge the operator and that the operator wouldn't be able to respond a successful answer and that's a smart contract will heart a malicious operator so such double spending attack will not be successful what are the costs so it is expensive to run such a such an committee well not really a checkpoint is roughly ten cents every 36 hours 36 hours is our around interval that we've chosen four hours just an arbitrary number just like the block time interval and people might argue about it but let's look at the cost less than 10 years dollars per month and gas costs for the operator can we support my clients yes so user storage is just a few checkpoints there are transactions of the last two rounds you have like roughly 300 bytes per transaction so it's really lightweight so you can you can run lightweight clients on the commission easy what does the user availability requirement we a user should be online at least once every 36 hours so that's I think that you might be able to outsource this task to Watchtower so if you look at the operation costs here for for example withdrawing points or initiating disputes what's interesting they grow with the number of users however they grow logarithmically so here on the x-axis if you look at the corner right you see the we account for 1 billion users in the commit chain and even with 1 billion users the costs of a dispute of after all remain below half a US dollar so just to give you a little demo so this is our mobile app where you can create a wallet just like any other trip to wallet and then here you have the the screen of your different points so what's important you can see here you have the ether balance which is the own channels but you have also be fast and free ether a version which is the version that's running on the commission and this is what you can send without any onchange transactions if you swipe down on our menu here we have a for sale so every 24 hours you can claim it for say for example in this case this would be some amount ether that you can claim if you click on it you get a transaction of the chain zero gas costs 300 so we have a an API we published an API on Docs that liquidated our network which allows you to integrate this into your wallets your decks suitable we'll be speaking tomorrow about our decks most bit more specifically on how to operate a decentralized exchange on the commit chain and yeah thank you very much our apps are available on on the App Store [Music]